Information Management Assessment

Department for Business, Innovation and Skills

Assessed in May 2013 The Information Management Assessment (IMA) entailed a detailed review of supporting documentation followed by interviews with senior staff, specialists and practitioners. These were conducted between 13 and 17 May 2013. The following report provides a summary of good practice and risks identified in the course of the assessment. The terms ‘information’ and ‘information management’ are used inclusively throughout and should be understood to cover both records and information unless otherwise specified.

IMA reports and departmental action plans are published on the National Archives website and can be accessed at:

http://www.nationalarchives.gov.uk/information-management/our-services/ima-reports-action-plans.htm Executive summary

1 The value of information

| Communicating and realising value | good practice | |-----------------------------------|---------------| | Managing information as an asset | development area |

- The development of the draft Knowledge and Information Management (KIM) strategy marks a significant step forward for the Department for Business, Innovation and Skills (BIS). The strategy clearly states why information and its effective management matters. The endorsement and backing of the senior team would be beneficial in ensuring this message is heard and acted on as BIS introduces new technology, policy and ways of working. The strategy establishes the role of good information management in supporting compliance with legal, regulatory and transparency obligations. BIS should build on existing arrangements to promote transparency outcomes, and champion information in overall terms at Board level.

- The department’s information asset management approach is at an early stage. However, it is evolving and has the potential to serve as a key tool to realise KIM strategy objectives. BIS should seek support and guidance from The National Archives as it defines and embeds its approach.

2 Digital information and supporting technology

| Supporting information through technology | development area | |-------------------------------------------|------------------| | Supporting digital information through change | satisfactory |

- The department’s Electronic Document Records Management System (EDRMS), Matrix, has delivered benefits in terms of its ability to support the protection and lifecycle management of information. However, a failure to meet user needs and expectations has driven shared drive usage, dispersing the corporate record and raising a range of risks to the department and its ability to protect, manage and exploit its information. A lack of enforced mandate for Matrix is also likely to have been a factor in this. In the long-term, BIS should seek to remove a key cause of the related risks highlighted within this report. This may be achieved by ensuring that any shared drives or other alternative repositories provided through the Future Information Management Solution (FIMS) project are established as part of a managed environment, and can be subject to central oversight and control.

- Since the IMA, BIS has defined business requirements for its information and moved to procure the system that will replace Matrix through the FIMS project. This report recognises that alignment of the FIMS project with wider work to renew the underlying technology infrastructure offers significant benefits. However, it also places the FIMS project under immense time pressure. BIS should ensure opportunities and threats in relation to meeting or not meeting requirements in practice for the use and management of information are fully defined so that they can inform decision making on system configuration, implementation and contingency planning. The potentially significant long-term strategic-level impacts should be recognised in both cases.

3 Information risk, governance and oversight

| Recognising information risk | development area | |------------------------------|------------------| | Setting direction | satisfactory | | Providing guidance | satisfactory | | Measuring Impact | satisfactory |

- The assessment team found limited recognition of information risk in overall terms within BIS. The profile of information risk should be elevated and key information risks should be recorded corporately so they can be managed and escalated as necessary. This should be understood to include risks raised by information management practice within the business, such as those resulting from a failure to manage information in accordance with its value.

- Once the draft KIM strategy is signed off, the key challenge will be in establishing a plan to implement it. Promoting and adopting new policy and guidance for knowledge and information management that reflects the new technology environment will be a vital element of this, supporting BIS to achieve its goal that ‘KIM is not an added task, it is how we work’. This will play a crucial role in encouraging the proper use of new systems ensuring that benefits can be realised. The department should ensure the KIM team and other work streams are supported to drive compliance.

- Current policy and guidance is well established, but the assessment identified gaps that should be addressed, including in relation to the provision and use of shared drives. The decision on the ongoing provision of shared drives must be enforceable through policy and BIS should provide clear guidance where continued use is necessary. In addition, BIS currently provides limited guidance to help staff identify what information has value and needs to be stored corporately. This would both help to ensure corporate information is captured, and to give staff confidence to identify and delete ephemeral information – something that will remain important as the new technology environment is introduced.

- BIS must ensure the department’s Board can monitor progress towards KIM strategy goals. The department should also define how metrics will be used to monitor information and records management practice on a business as usual basis.

4 Records review and transfer

| Oversight of records and selection | good practice | |-----------------------------------|---------------| | Implementing disposal decisions | satisfactory |

- BIS is to be commended for its work to apply retention to Matrix and for the records review team’s work to oversee a smooth transition from the department’s file store, Westfield House. The latter was conducted alongside business-as-usual work and is an example of good practice. To ensure best use of reduced resources in light of the increased workload required under the twenty year rule, this report recommends that BIS defines a clear plan for review of accruing records series and agrees this with The National Archives.

### Highlights table

The following are among the areas of good practice specifically highlighted in the body of this report:

| | | |---|-------------------------------------------------------------------------------------------| | 1 | **The draft BIS Knowledge and Information Management strategy has the potential to act as a key driver for change, once endorsed and signed off.** The draft strategy is aligned to the Information Principles for UK Government and establishes the importance of improving how knowledge is shared and how the value of information is understood and realised. It underlines the benefits of good practice in information management in terms of business outcomes, and in terms of compliance with department’s obligations under information legislation and the government’s transparency agenda. | | 2 | **BIS defines its information assets in an open and inclusive, best-practice manner and the KIM team is working to increase oversight and understanding.** In line with the requirements of the Information Principles, this could support BIS to look beyond the provision of assurance on the security of information assets to enabling their effective management and exploitation. | | 3 | **BIS has worked hard to define business requirements for its information.** The Future Information Management Solution (FIMS) project board is chaired by the Senior Information Risk Owner (SIRO), and includes the Departmental Records Officer (DRO) and Head of the Ways of Working (WOW) programme. This puts BIS in a good position to ensure the current focus on how information needs to be managed and used is maintained. | | 4 | **BIS has well-established policy in place for information and its management.** Related policy and guidance covering mailbox management sat within the overall framework. This and guidance on EDRMS use supplied to the assessment team were delivered from an information management rather than solely technology focussed perspective. | | 5 | **BIS has successfully reduced its legacy of paper records due for transfer to The National Archives.** Work was carried out in the course of the transition from an in-house paper store at Westfield house to one provided by the department’s contractor, TNT. A large-scale transfer was successfully carried out alongside business-as-usual work. | | 6 | **The BIS Electronic Records Appraisal project enabled the application of retention to digital records.** The department also developed search criteria by which files of potential historic interest might be identified within the Electronic Document and Records Management System, Matrix. |

## Recommended actions to address risk areas

| Ref. | Priority recommendations | |------|--------------------------| | 1 | **BIS to elevate the profile of information risk in support of KIM strategy aims for the protection, management and exploitation of information.**\
This would be supported by:

- Establishing policy on information risk. As with guidance for Information Asset Owners (IAOs) referenced below, this should be explicitly aligned with the KIM strategy goals.
- Ensuring information risks are documented corporately, such as risks resulting from a failure to manage information in accordance with its value, with clear escalation paths so that strategic impacts can be recognised. This work could draw on risks already defined within KIM policy and through the FIMS project together with those highlighted in the body of this report.
- Clearly establishing tolerances and appetites for information risk. | | 2 | **BIS to ensure lessons are learned from the adoption of Matrix and use of alternative repositories and ensure requirements for the use and management remain at the heart of the FIMS project. These must inform decision making on configuration, implementation and contingency planning.**\
  Key requirements in this regard include discovery, ease of use together with current strengths of the EDRMS such as access controls and lifecycle management. This would be supported by:
- Ensuring the risks of meeting and not meeting business requirements in practice are fully defined, and that the potentially significant impacts have visibility beyond the FIMS project.
- Close liaison with the business to identify key needs and help prioritise migration.
- Maintaining control and oversight of the technology environment as a whole following roll-out of new systems, particularly in terms of any necessary additional or alternative repositories.
- Mapping usage requirements of key information assets in line with The National Archives guidance. | | 3 | **BIS to produce a clear and detailed implementation plan for its KIM strategy to define how threats will be reduced, opportunities realised and outcomes delivered.**\
  This would be supported by: |
- Aligning the work and deliverables of the KIM team and that of other stakeholders to strategy outcomes
- Developing a plan to promote and drive the adoption of new policy and guidance for information management during and following system roll-out.
- Directing policy and guidance towards cultural barriers to good practice and system usage such as perceived lack of time to capture information corporately.
- Identifying quantifiable performance indicators and success criteria, defining how these will be used to target risk areas and potential areas of good practice.

### 4 BIS to support KIM strategy goals and vision through a consistent and mutually supportive suite of policy and guidance.

To deliver maximum benefit, this policy and guidance should:

- Define how KIM strategy outcomes and vision enable the achievement of specific business objectives and BIS Values and Behaviours.
- Establish how individuals, the SIRO, deputy SIRO, IAOs and key KIM governance roles support KIM strategy outcomes.
- Be pragmatic, user focused, interrelated and clearly aligned to the technology and business environment.

### 5 BIS to build on the foundations already in place for transparency and champion information and its management at Management Board level.

This would be supported by:

- The clear endorsement and support of the Board for the KIM strategy.
- Defined reporting requirements for the KIM strategy, including criteria for exception reporting, so the senior team can be kept informed of progress towards goals.
- Recognising the KIM team’s role in establishing and ensuring the proper use of new systems.

### Secondary recommendations

| Ref. | BIS to engage with the business to produce guidance that supports staff to capture and manage information according to value. | |------|------------------------------------------------------------------------------------------------------------------| | 6 | This should be embedded within new policy and guidance in support of KIM strategy aims. The success of this approach would be helped by: |

- Engaging with business units to devise tailored solutions and buy-in of managers.
- Ensuring a clear message on what information is ephemeral and should be deleted.
- Defining the development and adoption of guidance as a risk reduction activity.
- Defining routine capture points for corporate information in support of the KIM strategy aim 'KIM is not an added task, it is how we work', and establishing clear rules around file closure to support routine disposal.

| 7 | BIS to ensure clear planning and defined decisions around migration of digital information from shared drives and Matrix in accordance with value. | |---|----------------------------------------------------------------------------------------------------------------------------------| | | This should include: | | | - Defining how technology supports the ‘usability’ of core information assets. | | | - Establishing how Electronic Records Appraisal project outcomes will be preserved throughout the migration process. In particular, explicit reference should be made to digital information already highlighted as having historic value, and action taken to preserve the accessibility and context of such records. | | | - Planning to test for complete transfer of context and metadata. |

| 8 | BIS to gain greater control and oversight of the shared drives and information they contain as it work to replace Matrix and roll out its new technology environment. | |---|----------------------------------------------------------------------------------------------------------------------------------| | | This would be supported by: | | | - Formally defining the risks raised by storing information within an unstructured and uncontrolled environment. | | | - An enforceable policy statement on provision of shared drives and clear guidance on their use where this needs to continue. | | | - Guidance on the discovery of information for business and Freedom of Information Act (FoIA) purposes across multiple repositories ahead of, during and following the introduction of the FIMS solution. |

| 9 | BIS to develop its information asset management approach in line with KIM strategy goals, with the support of The National Archives. | |---|----------------------------------------------------------------------------------------------------------------------------------| | | This requires: | | | - Clarity on the delivery of the information asset definition. BIS needs to be clear on type and level of information asset to be captured and focus on maintaining a manageable Information Asset Register by, for example, splitting it by directorate. | | | - Clear definitions in relation to value, quality and usability and clear reporting |

- A review of guidance to ensure it supports effective delegation of risk from the SIRO and reflects goals for the protection, management, exploitation and re-use of information assets. Guidance should be explicitly aligned with the KIM strategy.

| 10 | **BIS to reinforce governance structures for information support roles to ensure they can drive good practice in accordance with information policy and KIM strategy aims.** | |----|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | To support this, BIS should: | | | - Define reporting requirements for Information Support Officers (ISOs) to promote policy and good practice. | | | - Consider how existing support roles, together with existing project and programme governance structures, can be used to best effect to support implementation of the KIM strategy before, during and after systems and infrastructure changes. |

| 11 | **BIS to develop a clear plan for the management and review of paper files to ensure the best use of review team resources and limited available space.** | |----|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | This should include: | | | - Documenting the file transfer process to support clear communication of roles and responsibilities. | | | - To meet legislative compliance and best practice, BIS should investigate and develop the process for transferring digital information of historic value to The National Archives. This should include a methodology for adapting current sensitivity review methodology to digital records. | 1 The value of information

1.1 Communicating and realising value

**IMA goal:** The organisation establishes information’s value in principle and supports the realisation of value in practice.

**Communicating priorities**

The 2010 BIS information management policy and the 2009 knowledge and information vision statement position information as the department’s ‘most valuable asset’ after its people, and one that accordingly needs rigorous management. The two documents are not formally linked and overlap rather than directly complementing each other, but provide useful summaries of the legal drivers for good information management. They also highlight resulting business benefits, such as effective operational delivery and policy making.

The production of the new BIS Knowledge and Information Management (KIM) strategy, based on the structure of the Information Principles for UK Government, offers the department an opportunity to build on this **good start**. The draft KIM strategy reviewed by the assessment team prioritises the effective and routine protection and management of information in accordance with value. It establishes these activities as foundational requirements for the exploitation of information, and fundamental to the fulfilment of business objectives and the BIS Values and Behaviours. **This is good practice.** To ensure the strategy can be promoted to best effect, BIS should make this explicit and align outcomes of good practice with specific corporate values and business objectives. BIS should also ensure that core principles and goals are consistently established across strategy and policy and across linked and supporting guidance. **See recommendation 4**

**Enabling public access to information and supporting transparency**

Latest available performance figures show BIS answered 99% of enquiries under the Freedom of Information Act (FoIA) within permitted extensions in the third quarter of 2012. BIS has shown a consistent improvement over the preceding year from a figure of 83% answered in time in the second quarter of 2011, and interviewees recognised that senior staff took performance under the act seriously.

The draft KIM strategy emphasises the department’s intention to surpass minimum standards of openness required under the FoIA. It highlights the need to consider how information could be readily migrated for publication from the department’s new information systems, and the role the BIS Transparency Board will play in driving good practice. Interviewees felt that BIS was on a ‘journey’ in terms of developing its approach under the transparency agenda, but recognised its importance to the department. This is underlined by direct alignment to the growth agenda and the appointment of the BIS finance director general and Senior Information Risk Owner (SIRO) as transparency champion and Transparency Board Chair.

**Establishing leadership and promoting value**

The assessment team found evidence that some managers understood their responsibility for driving good practice in information management and were consequently providing strong leadership. However, this picture was not found or said to be consistent, and not all interviewees recognised information management as a priority area for BIS. As one manager noted, ‘the more senior you are, the less likely you are to use the systems’.

The draft KIM strategy sets out the benefits of good practice in information management and establishes a clear intention to improve performance. For this message to be recognised and acted on, BIS needs to ensure visible and effective endorsement and support from its senior team. This is particularly crucial now as BIS faces a period of significant technology change and seeks to establish new ways of working. The visible priority currently attached to the transparency agenda has been effective in sending out a strong message that this is an area that is of core importance to the department. BIS should build on this platform and ensure that the information agenda is championed in the widest sense. **See recommendation 5** 1.2 Information Asset Management

**IMA goal:** The organisation protects, manages and exploits its information as an asset to achieve maximum value

**Defining and cataloguing information assets**

At the time of assessment, the BIS Knowledge and Information Management team was leading an exercise to increase oversight of its information assets. This was driven by direct contact with individual business areas. At the same time, the BIS’ Information Asset Register (IAR) was being reviewed to support the collection of more detailed context.

As the IAR was not yet fully populated, the assessment team could not judge whether BIS is yet obtaining the right detail to provide effective assurance and support effective and consistent management. However, the department’s refocused and re-energised approach has the potential to deliver a deeper and richer understanding and to enable the achievement of key KIM strategy outcomes.

To this end, BIS should ensure that ‘value’ in this context is seen to have wider meaning than the risk of loss. BIS should also ensure its information asset management approach supports requirements around information quality under KIM strategy principle 3 ‘information is fit for purpose’. By addressing these gaps and ensuring its information asset management approach in overall terms is aligned with KIM strategy outcomes, BIS would be better able to put its information assets to work in support of transparency aims, helping it aggregate and search for new data. **See recommendation 9**

BIS describes an information asset as: ‘a body of information, defined and managed as a single unit so it can be understood, shared, protected and exploited effectively.’

**This is a good practice definition** in line with The National Archives digital continuity guidance and the Information Principles. In theory, this definition allows BIS to consider unstructured as well as structured information. The definition could also support BIS to address wider issues relating to the protection, lifecycle management and exploitation of information in addition to those relating to the security of information. However, BIS does not yet have full coverage and its approach is, in overall terms, at an early stage. As a result, BIS needs to be clear whether it intends to follow through on its definition of an information asset and wishes all information that the department handles and works with to be within scope. Precedents in this regard include The National Archives’ Information Asset Profile, which is built on ‘What to Keep’ schedules.

BIS currently logs its Information assets in a single spreadsheet. This may become increasingly unwieldy as more information assets and context is added. If the IAR becomes overly complex it will not support consistent logging of individual information assets and effective oversight, becoming a document to maintain rather than a useful tool. To avoid this, BIS should consider establishing a controlled vocabulary to cover generic information assets. Alternatively, it may be possible to split the IAR by, for example, directorate, by format or type of asset, or by risk or impact – physically dividing a ‘single’ register across a number of documents or sections.

The KIM team’s ownership of the review of information assets and their management through the IAR provides a good starting point from which to develop the department’s approach. BIS should take advantage of support available from The National Archives as it seeks to build on the work already conducted and develop its information asset management approach. BIS should also seek to learn lessons from other organisations within the IMA programme such as Her Majesty’s Revenue & Customs (HMRC) and the Ministry of Defence (MOD) on the development, use and adoption of Information Asset Registers. See recommendation 9

Ownership of Information assets The assessment team found low recognition of the Information Asset Owner (IAO) role and responsibilities among interviewees. Guidance supplied to the assessment team suggests that there has previously been an expectation that the business will identify information assets, nominate owners and keep the centre informed of any key changes.

As BIS works to develop its approach, clear top-down control would be more appropriate with particular emphasis given to the SIRO as the ultimate risk owner. Without a clearly defined and controlled reporting structure, the SIRO may be unsighted on key risks to information assets and IAOs may be unaware of the need to escalate them.

At the same time as defining the scope of its information asset management approach, BIS should seek to grow the IAO role, developing a network and building awareness and understanding. There would be benefit in conducting a review of guidance to establish requirements in line with the KIM strategy, giving emphasis to key objectives such as overcoming the barriers to reuse. The National Archives’ Information Asset Owner Toolkit may represent a helpful model. See recommendation 9 2 Information and supporting technology

2.1 The technology environment

**IMA goal:** The technology environment supports the management, protection and exploitation of information

**Corporate storage of information**

The department’s Electronic Document and Records Management System (EDRMS), Matrix, was introduced in 2001 and last upgraded in 2007. The supplier will withdraw technical support for this system in 2014. At the time of assessment, BIS was seeking a replacement for Matrix through its Future Information Management Solution (FIMS) project.

Matrix uses HP TRIM software and provides staff with a structured and managed repository for corporate information. The EDRMS supports lifecycle management of digital documents from creation through to disposal and can be monitored and controlled centrally. It also supports the preservation of key context by allowing users to retain multiple corporate versions, link documents and group folders.

These benefits are currently diminished by the existence of over 100 individual shared drives. These are officially made available only for the storage of access databases and linked spreadsheets, which Matrix does not support. In practice, however, their use is much wider than this, and business areas are using them routinely and in preference to Matrix for the storage of corporate information.

The proliferation of shared drives and their unstructured and unmanaged nature has dispersed and fractured the corporate record. This makes information harder to protect and manage according to value. Because folder structures are not subject to centrally defined rules and users can create new folders at any level, there is a risk that stored information will become lost or orphaned. Because retention is not applied to the shared drives there is a risk that key information will be kept for longer than needed or deleted when it should be retained. Potential effects range from difficulties complying with the requirements of the Data Protection, Freedom of Information and Public Records Acts to inefficiency and inability to provide context or evidence of past decisions. Locally defined file structures do not facilitate understanding of what information is held, raising risks to the department’s ability to exploit information and provide timely responses to enquiries under the FoIA. The situation is complicated by pending ICT change and the need to either migrate information with ongoing value from the shared drives or manage it in situ according to value through to disposal.

BIS has defined through the FIMS project risks relating to migration from shared drives and the impact on behaviours that their continued provision may have once a replacement for Matrix is in place. In the short term, and as a component of work to document information risk recommended by this report, BIS may gain benefit from defining and documenting corporately the wider threats raised by continued use of these unstructured repositories. This report recognises as a means of mitigating these risks the continuation of current work to gain oversight of the information stored within them. This is being done as a component of the FIMS project.

In the longer term, BIS aims to restrict the availability of alternative repositories such as shared drives through the FIMS project. However, where shared drives or equivalent repositories do fall within the scope of the FIMS project, a key cause of risks related to their usage would be removed by ensuring that they can be subject to corporate oversight and control. BIS should ensure clarity over the reasons for their provision and the ways in which they should be used. Where such repositories are needed, they should be established as a component of the managed technology environment. See recommendations 2 and 8

Meeting current user requirements Where systems do not meet business requirements in practice, the use of workarounds may become necessary. In one example given to the assessment team, an interviewee stated that potentially sensitive information was routinely encrypted and couriered between offices. The interviewee stated that this was not done because of the inherent sensitivity of the information, but rather because two teams needed to work on it, and ‘systems didn’t speak to each other’.

A belief (rightly or wrongly) that systems do not meet business needs may also provide a justification for opting out of corporate systems. Some interviewees from areas reliant on shared drives suggested that Matrix did not meet the requirements of a fast-paced work environment. Others stated that it was more ‘pragmatic and practical’ to manage information in personal drives and inboxes – an approach that carries risks for the individual user and BIS as a whole in light of the department’s automatic 12-month email deletion policy. This policy is a potentially useful way of restricting the growth of ephemeral information – but only if information with ongoing value is saved to corporate repositories.

Matrix is intended to facilitate cross-team working by allowing documents to be edited and updated before being finalised. However, interviewees described the EDRMS as ‘unforgiving’, because documents filed by accident could not be deleted, and ‘clunky’. Interviewees suggested that Matrix was ‘not suited to collaboration’, highlighting, for example, the number of clicks it takes to link a file in an email.

The benefit of the EDRMS most frequently recognised by interviewees was the ability to control access to information. In contrast, difficulty finding information stored within it was the most frequently voiced criticism. This was despite the fact that Matrix is intended to allow saved and tailored searches, and includes paper files within search results. Interviewees stated that contents searches were impractical, and highlighted the number of results returned and the difficulty locating required information because of poor titling. One staff member commented ‘people need to name sensibly; it’s easy to search for information, but it’s not necessarily easy to find it.’ Through the FIMS project, BIS has a huge opportunity to address known barriers to EDRMS adoption such as ease of use and discovery of information, while maintaining the benefits Matrix currently offers in terms of protecting and managing information through defined lifecycles. Doing so will help ensure the provision of an enabling environment that supports business requirements and the achievement of KIM strategy goals. It is crucial that the lesson of how user expectations have impacted EDRMS uptake is learned and reflected in the new system’s configuration and roll-out as discussed below.

Alongside work to gain oversight of the shared drives, BIS should provide a clear policy statement and straightforward guidance where use needs to continue. Ahead of the roll-out of the new system, BIS should in overall terms give consideration to the ongoing requirement for capture of information with corporate value. Staff need to be clear where information should be stored in this interim period and also where they need to search to find information for business purposes and in response to enquiries under the FoIA. See recommendations 2 and 8

2.2 The continuity of digital information

IMA goal: The organisation is taking proactive steps to assure the continuity of its information over time and through change

Aligning information management and information technology

This report recognises that BIS has consulted with The National Archives as it maps requirements for the EDRMS replacement through the FIMS project. However, BIS has yet to begin mapping the requirements of individual information assets and defining how these are and need to be supported by technology. BIS should refer to The National Archives’ digital continuity guidance in this regard. This will help BIS to ensure non-standard requirements in relation to individual information assets are captured ahead of migration so they can be factored in to the process. See recommendation 2 BIS should ensure that current applications discovery work is linked to the review of the department’s information asset management approach.

**Considering digital continuity ahead of change**

BIS has aligned the FIMS project with wider work to renew and replace hardware and infrastructure as it transitions from the Fujitsu ELGAR contract to the FLITE contract. BIS has positioned FIMS and FLITE as core to the department’s Ways of Working (WOW) change programme. The Chair of the project Board at the time of assessment was the deputy SIRO and Chief Information Officer (CIO) for core BIS. Members included key stakeholders such as the DRO and the Head of the WOW programme. **This is good practice.**

Alignment with FLITE, while bringing many benefits, has imposed tight deadlines to source and implement a replacement for Matrix. The assessment team is assured that the project is considering this risk and has defined for itself through the FIMS project the potentially critical impact of not procuring a system that meets business requirements. This report recognises that since the May 2013 visit to BIS offices, the department has defined its business requirements and procured a solution. BIS now needs to decide how the system will be configured and implemented.

It is The National Archives’ experience that an ‘out-of-the-box’ solution is likely to require the establishment of rules and automated processes to ensure ease of use and enable staff to get the best from it. Configuration is therefore likely to be necessary to achieve the department’s goal of providing a system that is simple, intuitive and supports smarter working. To inform decision-making on configuration, and on contingency planning if tight deadlines cannot be met, this report recommends that BIS fully defines opportunities and threats relating to meeting and not meeting business requirements in practice. These have potential implications for the department’s ongoing ability to find, open, trust, work with and understand information and by extension the ability to manage, protect and exploit it. Potential long-term worst-case scenario impacts extend to adoption and use of the system and compliance, with implications for the achievement of predicted cost savings. BIS should ensure the potential significance of relevant risks is recognised and ensure visibility beyond the FIMS project. See recommendation 2

Particular attention must be paid to plans for the migration of digital information to the new system from Matrix and the shared drives. Risks that must be considered include not migrating information with value into the new system, and at the other extreme, moving information without value across. BIS must ensure that necessary metadata is preserved and the usability of digital information can be maintained following transfer. In specific terms, BIS should take a clear decision on the handling of digital information highlighted as having historic value under the Electronic Records Appraisal project, and ensure a clear disposal decision is taken on any information not migrated to the new system. BIS may also benefit from liaising with the Ministry of Justice (MOJ) on approaches used to assess readiness for migration. See recommendation 7 3 Information risk, governance and oversight

3.1 Recognising information risk

**IMA goal:** The organisation defines and manages information risks to minimise threats and maximise opportunities

**Information risk management approach**

The BIS risk management policy was produced under the department’s predecessor organisation, the Department for Business, Enterprise and Regulatory Reform (BERR). It establishes general principles for oversight of long-term risks and for their escalation to group and management board risk registers. Information risk is not explicitly referenced and BIS lacked a separate policy covering its management at the time of assessment.

The establishment of a framework for information risk assurance and risk management is a core requirement of the Information Principles and, by extension, of the department’s draft KIM strategy. The establishment of a comprehensive information risk management policy is a crucial first step that will support BIS not only to protect and manage its information according to value but also to make risk-based decisions on its exploitation. The establishment of an information risk policy is particularly important now as BIS stands poised to overhaul its IT infrastructure.

This report recommends that information risk policy should be established as part of the overall risk management framework and aligned in support of the KIM strategy. Cabinet Office guidance states that it should be owned by the Management Board. The policy must establish clear definitions, tolerances and escalation routes. It should also clearly communicate the roles and responsibilities of the SIRO and deputy SIRO, IAOs and key information governance roles such as the DRO. **See recommendation 1**

**Documenting and defining information risks**

The assessment team found evidence that some key information risks are recognised corporately. The current policy for the management of information in electronic mailboxes, for example, provides a clear description of some key risks and their implications in legal, reputational, budgetary, efficiency and performance terms.

At a business level, some interviewees exhibited a good level of awareness of risks in terms of the availability of information, and their possible effect and impact. However, BIS currently lacks a separate information risk register and the assessment team was unable to review the corporate risk register to ascertain coverage. Senior staff interviewed, including information specialists, were unaware whether information risk was represented at this level and if so in what form.

BIS is planning to develop a SIRO risk register, which may go some way to addressing this gap. Through this or via a standalone KIM risk register, BIS should ensure that overarching threats and opportunities relating to technology and information management governance, policy and practice are captured alongside mitigating actions. BIS should ensure that their potential high-level impact is recognised so that risks can be interrogated at Board level where necessary. Risks already defined within KIM policy and through the FIMS project may form a useful basis for this work, together with the risks highlighted in the body of this report. See recommendation 1

3.2 Setting direction

IMA goal: The organisation has effective governance structures for information in place that foster communication and planning

Governance and planning The BIS KIM team are heavily involved in work to identify a successor to Matrix. At the same time the team continues to promote the use of corporate systems and work with the business directly and in response to queries. The head of KIM is also the DRO and has a direct reporting line to the deputy SIRO and CIO for core BIS. This arrangement has the potential to support effective communication on information risk as well as progress to deliver KIM strategy goals, as explicit responsibilities are defined. This is particularly important in light of the key role that the KIM team will assume in driving compliance in relation to the corporate management of information stored within the new system and in driving its appropriate and effective use. See recommendations 4 and 5

Supporting roles Following a 2010 review, the KIM team has allocated a team member to support each core BIS Group with local support provided through Information Support Officers (ISOs). The Group Information Manager (GIM) and Information Manager roles that were superseded in core BIS following this review still operate in partner organisations.

BIS provided a summary of responsibilities for each of the above roles. These outline how the KIM partner supports their Director General in the achievement of governance responsibilities. They also underline the need for a good overview of the business of the group and the desirability of professional qualifications. This is good practice.

KIM team members were engaging with staff in business areas visited by the assessment team during the IMA, indicating an active rather than passive approach. However, the profile of the team varied across the organisation, and its influence tended to be recognised more in terms of promoting Matrix use than tackling bad practice activities such as uncontrolled shared drive use. The assessment team also found that reporting requirements for ISOs are not defined in the role description and feedback to the KIM team is currently happening on an ad-hoc basis only. BIS could gain further benefit from this role and should establish formal reporting requirements and seek to build the network. See recommendation 10 Although the provision of extra resources has been recently agreed, the KIM team’s ability to engage with the business will remain limited and need to be prioritised. BIS should decide in overall terms how supporting roles and existing structures can be used to best effect to support implementation of the KIM strategy, before, during and after systems and infrastructure changes. See recommendation 10

Information goals The development of the draft KIM strategy addresses a key gap and marks a significant step forward for BIS. The department has now established where it wants to get to and why it is important to do so. The challenge will be in identifying how to realise the strategy’s goals and in developing a detailed plan for their delivery. See recommendation 3

The large-scale infrastructure change that BIS is soon to undergo will necessarily assume a high profile within the department. There is accordingly a danger that ICT change will be seen as an end in itself that will automatically address current shortcomings of policy and practice and drive the efficient management and exploitation of information. This view must be avoided. Once core requirements for the new system have been identified, the next step is to ensure the stated and planned purpose is met. The KIM strategy’s stated aim of moving to a point where ‘KIM is not an added task, it is how we work’ is therefore key. It recognises the need to improve behaviours and drive a significant culture change in the way staff work with and use information. This is a good practice approach.

BIS should ensure that KIM strategy goals are embedded as core to the WOW programme to inform its engagement strategy. BIS must also ensure the KIM team and other key areas of the business are efficiently aligned and have the support of senior staff to reduce threats relating to information management practice and, just as importantly, realise opportunities. See recommendations 3 and 5 3.3 Providing guidance

**IMA goal:** The organisation gives staff the instruction they need to manage, protect and exploit information effectively

**Information management policy and guidance**

The assessment team are aware that the KIM team is continuing to promote Matrix training, via induction and refresher courses, even though the EDRMS is due to be replaced within months. BIS has produced comprehensive guidance on Matrix usage as evidenced by the ‘Quick and Easy Guides’ provided to the assessment team. These are tailored rather than ‘one size fits all’, delivered from an information management rather than a solely technology perspective and are clearly positioned to help users get the most out of the system. **This represents good practice.**

Current policy establishes the necessity of capturing information with value corporately and provides a clear definition of a ‘record’ as a subset of BIS information. It also provides a clear definition of a record in line with the Section 46 Code of Practice on Records Management, as information ‘created, received and maintained as evidence by the department in pursuance of legal obligations or in the transaction of business’.

Policy places personal responsibility on all staff ‘to be accountable for the effective management of the department’s information’ and for line managers in particular to ensure compliance. **This is good practice.**

However, the lack of coverage given to shared drives represents a key gap that has had a significant impact. A one-page G-drive policy supplied to the team outlines the narrow exceptions in which use of shared drives is acceptable. The policy does not explicitly prohibit their use beyond this and shared drives are not referenced within information management or email policy or in the department’s standalone records management policy. BIS has neither removed shared drives nor enforced standards around the information stored within them. This has resulted in something of a grey area, and staff using the shared drives are doing so without recourse to corporate guidance. As detailed above, BIS needs to take a risk-based decision on the continuing provision of shared drives. This must be clearly reflected in and enforceable through departmental policy. See recommendation 2 and 8

BIS recognises the potential role of clear policy for information and its management in mitigating information risk. The department now has the chance to establish a new mandate for information and knowledge management and sell the benefits by establishing a mutually supportive suite of policy and guidance. This should be tailored to the technology environment and reflect the available knowledge and information management systems and tools – a considerable range of which were highlighted by interviewees including Yammer, e-case, Huddle, MySites and BIS and UKTI Connect. In line with KIM strategy goals, BIS must also ensure that policy is directed towards key cultural barriers to routine good practice in information management. These include a perceived ‘lack of time’ to identify information that has value and needs to be stored corporately, and the belief that there is benefit in ‘hoarding’ rather than sharing information. See recommendation 3

Knowing what to keep BIS currently maintains a standalone records management policy. The department should consider whether it needs to establish principles separately, or whether these could be covered within general information policy and guidance. If still required, it should be established within the same framework. Combining the records management policy may be helpful in encouraging staff to move away from the idea of ‘archiving’ and a focus on end products and end of process. See recommendation 4

If staff are to be able to effectively manage information through its lifecycle in accordance with value, as required by the KIM strategy, BIS needs to support them to routinely judge what information needs to be kept in the first place. BIS currently provides some instruction in this area, but it is generic and distributed across policy documentation and individual EDRM training documents. This report identifies the lack of consolidated and tailored guidance on what needs to be saved corporately as a key gap that BIS needs to address and promote through its new information policy, and embed within its WOW programme.

Without clear guidance there is a risk that information that needs to be kept for legal, regulatory or business purposes will not be retained corporately. Equally importantly, a lack of clarity may lead to duplication and the unnecessary storage of ephemeral information. Key effects of this include unnecessary storage costs and inefficiency due to increased difficulty finding, sharing and reusing information. For BIS this raises key secondary risks around the achievement of information strategy goals and uptake of the new system. The coming changes to the technology environment and decisions around a single repository will affect the likelihood and impact of this risk. BIS needs to document these risks and then manage them through the development of tailored guidance in conjunction with individual business units. See recommendation 6

3.4 Measuring impact

**IMA goal:** The organisation measures performance in practice and takes informed risk-based action as a result

**Assessing progress against strategic goals** The information strategy includes a commitment to regularly assess progress against a measure for each of the strategy’s individual commitments. At the time of assessment these had not yet been devised.

Regular review is crucial to understanding the strategy’s progress in driving change and improvements, and supporting the achievement of corporate objectives. BIS should ensure that robust, quantifiable performance measures and success criteria are identified. In view of the strategy’s potential impact on efficiency and effectiveness and in the reduction of risk, BIS should establish requirements for progress to be reported to the department’s senior team, including criteria for exception reporting. See recommendation 5 Understanding compliance with policy

BIS collects and uses statistics to highlight areas that save or access a limited number of documents within Matrix. It has also included monitoring requirements in its specifications for the EDRMS replacement. As BIS prepares to draw a line under the current technology environment and puts in place new systems, new policy and new ways of working, monitoring will become increasingly important. BIS must identify key performance indicators in terms of corporate storage and decide how these will be used to identify and target risk areas and potential areas of good practice. This should include processes for escalation and exceptions reporting. See recommendation 3 4 Records review and transfer

4.1 Oversight of records and selection

IMA goal: The organisation understands the value of its records and can consistently identify those with enduring historical value

Oversight and control of records The DRO also holds the Head of KIM role, which puts BIS in a good position to ensure requirements and risks relating to the Public Records Act achieve the right profile and prominence within the organisation.

Key recent changes for the department include the closure of its internal file store, Westfield House. The transition from an internally managed facility to outsourced file storage was the result of extensive work undertaken by the Records Review Team. Paper files of business and historical value were identified in conjunction with guidance from The National Archives, and a large-scale transfer was undertaken alongside ongoing business-as-usual work within the department. **BIS should be commended for this work.**

BIS has a good understanding of records held by its contractor, TNT. Paper files are logged and tracked through Matrix and surfaced in EDRMS searches alongside digital documents, which makes these readily available as a resource for staff to draw on. BIS is currently working to identify business areas that are still generating paper files to ascertain whether there is a genuine and continuing business need to do so.

Appraisal and Selection The process of digital appraisal is an example of **good practice.** In 2009 and 2010 BIS developed the Electronic Records Appraisal project, which recognised the need to dispose of digital files when they were no longer needed, as well as marking files for The National Archives without performing a file by file review. This approach was signed off by The National Archives’ Records Decision Panel and a set of criteria was developed by which BIS could search Matrix for folders that are likely to be of interest. The first digital records are due to be transferred in 2022.

BIS has traditionally engaged readily with The National Archives when seeking sign off on paper files identified as having historical value that may merit permanent preservation. BIS makes use of a second review summary form, which it presents with lists of review decisions. This provision of additional context to review decisions is another example of good practice.

4.2 Implementing disposal decisions

IMA goal: The organisation understands the records disposal process and consistently implements decisions in line with defined plans

File closure As highlighted above, retention is not established within shared drives. However, within Matrix BIS has established a standard retention period of eight years for all digital information with exceptions set for information that needs to retained for longer for legal, business or regulatory purposes. Once deleted, stubs are retained within Matrix showing what has happened to the relevant documents. This is good practice.

With the exception of folders for Parliamentary Questions, which are closed manually after a year, folders on Matrix remain open for five years from the date first created. The assessment team found some evidence that when folders were closed staff were simply opening a new folder with a slightly different name, raising the risk of a loss of context when reviewing for retention period or searching for related documents. Often, folders are set up for projects that only last for six months. Staff are encouraged to stop using folders after this point, but as staff cannot themselves close them, retention periods are not begun and folders may roll on as they are added to. As well as applying retention, BIS must ensure clarity and tight control on closure within the system that replaces Matrix to support routine disposal of digital information. See recommendation 6

**Sensitivity review**

The need for an overall plan for the records review process is underlined by the potential pressures imposed by the need to sensitivity review paper files. Although costly and time-consuming, this is a necessary process and BIS must ensure that time needed to discover and remove any personal details from files is properly planned.

Sensitivity review of digital records hasn’t yet happened. The department is yet to define an approach, which means that reviewing for sensitivity is effectively stopping the early transfer of digital records to TNA. The department understand that this is the case, but no plans have been made to tackle the issue.

**Disposal and planning to transfer**

Following closure of the Westfield House paper store, the BIS review team has reduced in size from ten staff to a team of two part-time staff. BIS took the opportunity provided by the closure of Westfield House to tackle and reduce a significant portion of its paper review backlog. BIS is to be commended for this.

However, the twenty year rule will at the same time bring an increased workload with a requirement to review and transfer two years worth of files every year. Although BIS has clear goals in meeting legislative compliance under the selection and transfer of historical records, and is currently coping, this report recommends that BIS produces a plan for the review of accruing records series and agrees this with The National Archives. This would support the department to adopt a best practice approach and begin defining its approach for digital sensitivity review and transfer. It would also ensure that the department can utilise resources to best effect. This is particularly important in light of variables which could have an effect on the department’s ability to comply with the Public Records Act. Examples noted by the assessment team include the temporary stop on conducting second review work following the outsourcing of paper storage, the pressures and resource requirements of the FIMS project and need to audit in-house storage facilities.

See recommendation 11

BIS clearly understands its statutory obligations to transfer paper files and digital documents for permanent preservation. However, BIS has not yet documented a defined and transparent process that maps how this transfer will happen now the files are held offsite. Files held at TNT now have to be called back to be appraised, sensitivity reviewed and catalogued, before being sent back to TNT for preparation, and eventual transfer to The National Archives or another place of deposit. The assessment team understands that BIS has conducted pilots to ensure the smooth running of this aspect of transfer. However, this report recommends that BIS should document this process from end to end so that roles and responsibilities can be clearly communicated. See recommendation 11